bt-cli 0.4.67__tar.gz → 0.4.68__tar.gz

{bt_cli-0.4.67 → bt_cli-0.4.68}/CLAUDE.md

@@ -1,6 +1,6 @@
 # BT-CLI
 
-BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, EPM Linux, and the BeyondTrust Secrets API. **Version: 0.4.67**
+BeyondTrust Platform CLI for Password Safe, Entitle, PRA, EPM Windows, EPM Linux, and the BeyondTrust Secrets API. **Version: 0.4.68**
 
 ## Setup
 

{bt_cli-0.4.67 → bt_cli-0.4.68}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bt-cli
-Version: 0.4.67
+Version: 0.4.68
 Summary: BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM
 Author-email: Dave Grendysz <dgrendysz@beyondtrust.com>
 License: MIT

{bt_cli-0.4.67 → bt_cli-0.4.68}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "bt-cli"
-version = "0.4.67"
+version = "0.4.68"
 description = "BeyondTrust Platform CLI (unofficial) - Password Safe, Entitle, PRA, EPM"
 readme = "README.md"
 requires-python = ">=3.9"

{bt_cli-0.4.67 → bt_cli-0.4.68}/src/bt_cli/__init__.py

@@ -1,3 +1,3 @@
 """BeyondTrust Unified Admin CLI."""
 
-__version__ = "0.4.67"
+__version__ = "0.4.68"

{bt_cli-0.4.67 → bt_cli-0.4.68}/src/bt_cli/data/skills/pws/SKILL.md

@@ -189,6 +189,11 @@ bt pws sessions list --active        # only live sessions (started, not ended)
 bt pws sessions list --all -o json   # full history
 bt pws sessions get <session_id>
 
+# "The session from today" — date filters match on StartTime (client-side)
+bt pws sessions list --today
+bt pws sessions list --on 2026-07-02
+bt pws sessions list --since 2026-06-01 --until 2026-06-30   # a range (e.g. "this week")
+
 # Suspend = lock (user disconnected, session can be resumed)
 bt pws sessions suspend <session_id>
 
@@ -241,6 +246,27 @@ prints the exact command + install instructions and leaves the frames. Works for
 RDP (screen) and SSH (rendered terminal). Gotcha: the renderer needs ~0.5s
 warm-up (first seek 404s), handled automatically.
 
+### "What happened in this session?" — summarize efficiently
+
+`replay` only *downloads* frames. To turn a session into a **timeline summary of
+what the user did**, don't read every frame — use the analysis pipeline:
+
+```bash
+bt pws sessions replay <session_id>       # 1. download the frames
+bt pws sessions analyze <session_id>      # 2. pick keyframes + anchor keystrokes + estimate cost
+```
+
+`analyze` is deterministic prep (no LLM): it selects the handful of frames worth
+reading — screen-change frames **plus** the frames that render what the user
+typed (keystroke-anchored, tagged `after-typing` with the `typed` text) — pulls
+the transcript, and prints a token/USD cost estimate. Then **invoke the
+`/session-analysis` skill**, which tells you (the agent) to read only those
+keyframes (after-typing first) and produce a timeline + auditor highlights (EPM
+elevation prompts, privileged tools, service/account changes) + a secrets-exposure
+note. For **SSH**, skip frames entirely — `analyze` points you at the transcript,
+which is the full input+output and far cheaper. This is the intended path for
+"show me / summarize the session from today".
+
 **Gotchas:**
 - `/Sessions` returns session **history**, not just active sessions, and **ignores `limit`/`offset`** (returns the full set every call - the client does a single GET, the CLI caps display client-side). Use `--active` for the live ones.
 - `Status` codes confirmed live: **0 = Not started, 1 = Active, 2 = Completed, 5 = Locked, 7 = Terminated** (3/9 are other terminal states). `--active` filters on Status == 1.

{bt_cli-0.4.67 → bt_cli-0.4.68}/src/bt_cli/pws/commands/sessions.py

@@ -5,7 +5,7 @@ import json
 import shutil
 import subprocess
 import time
-from datetime import datetime, timezone
+from datetime import date, datetime, timezone
 from pathlib import Path
 
 import httpx
@@ -35,6 +35,41 @@ SESSION_STATUS = {
 }
 
 
+def _norm_date(value: str) -> str:
+    """Validate a YYYY-MM-DD (or ISO) date arg and return its date portion."""
+    try:
+        datetime.strptime(value.strip()[:10], "%Y-%m-%d")
+    except (ValueError, AttributeError):
+        print_error(f"Invalid date '{value}'. Use YYYY-MM-DD.")
+        raise typer.Exit(2)
+    return value.strip()[:10]
+
+
+def _resolve_date_window(today: bool, on: str, since: str, until: str) -> tuple:
+    """Collapse the date flags into an inclusive (lo, hi) date window (YYYY-MM-DD
+    strings, either may be None). --today/--on pin both ends to one day."""
+    if today:
+        d = date.today().isoformat()
+        return d, d
+    if on:
+        d = _norm_date(on)
+        return d, d
+    return (_norm_date(since) if since else None, _norm_date(until) if until else None)
+
+
+def _started_in_window(s: dict, lo: str, hi: str) -> bool:
+    """True if the session's StartTime date falls within [lo, hi] (ISO date
+    strings sort lexicographically, so string compare on the date is correct)."""
+    d = (s.get("StartTime") or "")[:10]
+    if not d:
+        return False
+    if lo and d < lo:
+        return False
+    if hi and d > hi:
+        return False
+    return True
+
+
 def is_active(s: dict) -> bool:
     """A session is live (suspend/terminate-able) when Status == 1.
 
@@ -99,6 +134,10 @@ def list_sessions(
     system: int = typer.Option(None, "--system", help="Filter by managed system ID"),
     active: bool = typer.Option(False, "--active", help="Show only active (started, not ended) sessions"),
     status: str = typer.Option(None, "--status", "-s", help="Filter by raw numeric status code"),
+    today: bool = typer.Option(False, "--today", help="Only sessions that started today"),
+    on: str = typer.Option(None, "--on", help="Only sessions that started on this date (YYYY-MM-DD)"),
+    since: str = typer.Option(None, "--since", help="Only sessions on/after this date (YYYY-MM-DD)"),
+    until: str = typer.Option(None, "--until", help="Only sessions on/before this date (YYYY-MM-DD)"),
     limit: int = typer.Option(25, "--limit", "-l", help="Max rows to show (most recent first)"),
     fetch_all: bool = typer.Option(False, "--all", help="Show all sessions (the endpoint returns full history)"),
     output: str = typer.Option("table", "--output", "-o", help="Output format: table or json"),
@@ -110,11 +149,17 @@ def list_sessions(
     suspend/terminate), or --all to see everything. Output is newest-first and
     capped at --limit by default.
 
+    Date filters (--today/--on/--since/--until) match on StartTime's date and are
+    applied client-side (the endpoint returns the full history every call).
+
     Examples:
         bt pws sessions list --active
+        bt pws sessions list --today
+        bt pws sessions list --since 2026-06-01 --until 2026-06-30
         bt pws sessions list --system 13
         bt pws sessions list --all -o json
     """
+    lo, hi = _resolve_date_window(today, on, since, until)
     try:
         with get_client() as client:
             client.authenticate()
@@ -122,6 +167,8 @@ def list_sessions(
 
         if active:
             sessions = [s for s in sessions if is_active(s)]
+        if lo or hi:
+            sessions = [s for s in sessions if _started_in_window(s, lo, hi)]
 
         total = len(sessions)
         shown = sessions if fetch_all else sessions[:limit]